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(54) Method for connecting a first user-terminal to a second user-terminal, related devices and 
related software modules 



(57) The subscriber data server handles an incom- 
ing call request from a first user-terminal in order to es- 
tablish a connection between the first user-terminal that 
is connected to a first virtual private network and the sec- 
ond user-terminal that is connected to a second virtual 
private network. The subscriber data server at first 
searches in its database for connection information of 
the second user-terminal and then determines the re- 
spective network access server that is connected to the 
second user-terminal based on the determined connec- 
tion information. Then the second user-terminal is noti- 
fied about the request for communication by the first us- 



er-terminal. The second user-terminal initiates and con- 
trols a switch-over of the connection of the second user- 
terminal from the second virtual private network to the 
first virtual private network. The respective network ac- 
cess server of the second user-terminal switches the 
connection of the second user-terminal from the second 
virtual private network to the first virtual private network. 
Then at the switch-over of the connection of the second 
user-terminal from the second virtual private network to 
the first virtual private network there is also connection 
information sent by the adjacent respective network ac- 
cess server to the subscriber data server. 
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Description 

[0001] The present invention relates to a connecting 
method as described in the preamble of claim 1 and the 
related devices as described in the preamble of claims s 
6, 8, 10, 11, 12 and 13. 

[0002] Such a method for connecting a first user-ter- 
minal to a second user-terminal is already known in the 
art, e.g. from the internet draft document "A FRAME- 
WORK FOR IP BASED VIRTUAL PRIVATE NET- 10 
WORKS' from the authors Bryan Gleeson et al f pub- 
lished in February 1999 by the Internet Engineering 
Task Force (IETF). Therein, a virtual private network is 
constituted by configuring all network access server ac- 
cess links, called stub-links in the referred draft, with the is 
identity of the particular virtual private network whereto 
the access link of the network access server belongs. 
[0003] In this way each user-terminal is assigned to a 
particular virtual private network in a static way. Each of 
the user-terminals assigned to a common virtual private so 
network are able to establish a communication with any 
other user-terminal assigned to the same virtual private 
network because information on the address of each 
connected user-terminal, called reachability information 
is available within the virtual private network. 25 
[0004] At the moment there is a first user-terminal be- 
ing assigned to a first virtual private network willing to 
establish a communication with a second user-terminal 
being assigned to a second virtual private network there 
is no way of connecting both user-terminals in order to 30 
establish a communication because there is no informa- 
tion available on the address of the second assigned to 
the second virtual private network. 
[0005] An object of the present invention is to provide 
a method of the above known type, a system, a network 35 
access server, a subscriber data server and a second 
user-terminal adapted to perform this method, but 
wherein access from a first user-terminal connected to 
a first virtual private network is able to connect to a sec- 
ond user-terminal connected to a second virtual private *o 
network. 

[0006] According to the invention, this object is 
achieved by the method described in claim 1, the net- 
work access server described in claim 6 and 8, the sub- 
scriber data server described in claim 1 0 and 1 2 and the <5 
second user-terminal as described in claim 11 and 13. 
[0007] Indeed, due to the fact that a subscriber data 
server is added to the network and that the necessary 
connection information is made available enabling to 
determine the location of the second, to be connected so 
user-terminal. This network element, the subscriber da- 
ta server is able to store and retrieve information on 
which the network access server the second user-ter- 
minal is connected to and the virtual private network the 
meant user-terminal forms part of. At a connection re- ss 
quest from a user-terminal forming part of a different vir- 
tual private network, the subscriber data server retrieves 
the connection information about the second user-ter- 



minal in order to locate this user-terminal. Subsequently 
the subscriber data server forwards a connection re- 
quest to the located second user-terminal. The second 
user-terminal in its turn decides on accepting the incom- 
ing call. If the incoming call is accepted, the user-termi- 
nal forwards a request to the network access server the 
user-terminal is connected to, to switch its connection 
from the current virtual private network to the first virtual 
private network. At the moment the switch is performed, 
both user-terminals form part of the same virtual private 
network. Then they are able to establish a communica- 
tion because address information of the second user- 
terminal is available and accessible for the first user- 
terminal in this context. 

[0008] Another characteristic feature of the present 
invention is described in claims 2 and 7 and in claim 3. 
[0009] The connection request of the first user-termi- 
nal may be sent from the subscriber data server to the 
second user-terminal via the network access server 
where this network access server in a active way for- 
wards the connection request received from the sub- 
scriber data server to the second user-terminal. On the 
other hand the connection request may be passed, as 
described in claim 3. over a transparent connection be- 
tween the subscriber data server and the second user- 
terminal via the network access server. These are alter- 
native solution for the transfer of the connection request 
between the subscriber data server and the second us- 
er-terminal. 

[0010] Further characteristic features of the present 
invention are mentioned in claims 4, 8 and 9 and in claim 
5. 

[001 1] The connection request of the first user-termi- 
nal may be sent from the first user-terminal to subscriber 
data server via the network access server where this 
network access server in a active way forwards the con- 
nection request received from first user-terminal to the 
subscriber data server. On the other hand the connec- 
tion request may be passed, as described in claim 5, 
over a transparent connection between the first user- 
terminal and the subscriber data server via the network 
access server connected to the first user-terminal. 
These are alternative solution for the transfer of the con- 
nection request between the first user-terminal and the 
subscriber data server. 

[0012] The above and other objects and features of 
the invention will become more apparent and the inven- 
tion itself will be best understood by referring to the fol- 
lowing description of an embodiment taken in conjunc- 
tion with the accompanying drawings wherein: 

FIG. 1 represents an internet network INW wherein 
the implementation of the present invention is real- 
ised; 

FIG. 2 represents the network access sever NASI 
of FIG. 1 ; 

FIG. 3 represents the subscriber data server SDS 
Of FIG. 1; 
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FIG. 4 represents the second user-terminal UT2 of 
FIG. l;and 

FIG. 5 represents the network access server NAS2 
of FIG. 1. 

[0013] In the following paragraphs, referring to the 
drawings, an implementation of the method and the re- 
lated devices according to the present invention will be 
described. In the first paragraph of this description the 
main elements of this network as presented in FIG. 1 
are described. In the second paragraph, all connections 
between the before mentioned network elements and 
described means are defined. In the succeeding para- 
graph the actual execution of the method for connecting 
a first user-terminal to a second user-terminal is de- 
scribed. 

[0014] An essential element of this embodiment of the 
present invention is a network constituted by the internet 
network INW. Further there is a number of user-termi- 
nals, but in order to keep simplicity in this description 
only two user-terminals UT1 , UT2 are presented. Both 
user-terminals UT1 and UT2 are chosen to be a person- 
al computer with a belonging screen and keyboard. Ad- 
ditionally there is a number of access nodes connecting 
each of the user-terminals to the internet network INW 
and taking care of subscription of the connected user- 
terminals to a virtual private network. Concerning these 
access nodes, also because of reasons of simplicity on- 
ly three access nodes NASI , NAS2 and NAS3 are de- 
scribed and presented in FIG. 1. These access nodes 
NASI, NAS2 and NAS3 are chosen to be network ac- 
cess servers. 

[0015) User-terminal UT2 is connected to network ac- 
cess server NASI via an Internet protocol link, further 
referred to as an IP-link. User-terminal UT1 is connected 
to network access server NAS2 via an IP-link. The net- 
work access servers NASI , NAS2 and NAS3 each con- 
stitute the edge of the internet network INW and are all 
interconnected via the internet network. The subscriber 
data server SDS is connected to each of the network 
access servers NASI , NAS2 and NAS3 over an IP-link. 
[0016] The network access node NASI as presented 
in FIG. 2. is built up ol the switch notification reception 
means SNRM, that is able to receive a request from the 
second user-terminal UT2 to initiate a switch-over of the 
connection of the second user-terminal UT2 from a sec- 
ond virtual private network to a first virtual private net- 
work, the switching means SM that is adapted to per- 
form the switch of the connection of the second user- 
terminal from a second virtual private network to a first 
virtual private network and a user-terminal connect no- 
tification sending means HCNSM that is adapted to 
send registration information to the subscriber data 
server at connecting or changing of the subscribed vir- 
tual private network of the second user-terminal to the 
respective network access server NASI . 
[0017] The switch notification reception means SN- 
RM has an input-terminal that is at the same time also 



an input-terminal l 4 of network access server NASI . The 
switch notification reception means SNRM further is 
coupled to the switching means SM which in its turn is 
coupled to the user-terminal connect notification send- 
s ing means HCNSM, that has an output-terminal which 
at the same time is an output-terminal O 0 of the network 
access server NASI. 

[0018] This network access server NASI optionally 
has the following means. At first there is a connection 
io establishment request reception means CERRM1 that 
is adapted to receive a connection request from the sub- 
scriber data server to establish a connection between 
the first user-terminal UT1 connected to a first virtual 
private network and the second user-terminal UT2 con- 
's nected to a second virtual private network. Further there 
is a connection establishment request sending means 
CERSM1 that is able to notify the second user-terminal 
UT2 about an incoming call from the first user-terminal 
UT1. 

20 [0019] The connection establishment request recep- 
tion means CERRM1 has an input-terminal that at the 
same time is an input-terminal l 2of the network access 
server NASI . The connection establishment request re- 
ception means CERRM1 in its turn is coupled to the con- 

& nection establishment request sending means 
CERSM2 that subsequently has an output-terminal that 
is at the same time an output-terminal 0 2 of the network 
access server NASI. 

[0020] Besides these means the network access 

30 node NASI as presented in FIG. 2. may also comprise 
a connection establishment request reception means 
CERRM2, that is adapted to receive a connection re- 
quest from the second user-terminal to establish a con- 
nection between the second user-terminal connected to 

35 the second virtual private network and the first user-ter- 
minal connected to a first virtual private network and a 
belonging connection establishment request sending 
means CERSM3, that is adapted to notify the subscriber 
data server about an incoming call from the second us- 

<Q er-terminal. 

[0021] The connection establishment request recep- 
tion means CERRM2 has an input-terminal that at the 
same time is an input-terminal l 4 of the network access 
server NASI . The connection establishment request re- 

45 ception means CERRM2 in its turn is coupled to the con- 
nection establishment request sending means 
CERSM3 that subsequently has an output-terminal that 
is at the same time an output-terminal 0 4 of the network 
access server NASI . These latest mentioned means 

so optionally are to be included in a network access server 
and excluding all other, previously mentioned means. 
[0022] Network access.server NAS2 and Network ac- 
cess server NAS3 have the same structure as the Net- 
work access server NASI as previously described. 

55 [0023] The Subscriber Data Server SDS as presented 
in FIG. 3 is built-up of the user-terminal connect notifi- 
cation reception means UTCNRM that is able to receive 
the connection information sent at connecting ot the 
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second user-terminal UT2 to network access server 
NASI or at switching a connection from one virtual pri- 
vate network to another. The user-terminal connect no- 
tification updating means UTCNUM is adapted to up- 
date the database DB of the subscriber data server with 
the connection information. Further there is a connec- 
tion establishment request reception means CERRM 
that is able to receive a connection request from the first 
user-terminal UT1 to establish a connection between 
the first user-terminal connected to a first virtual private 
network and the second user-terminal connected to a 
second virtual private network. The registration informa- 
tion searching means RISM is adapted to search in the 
database DB of the subscriber data server SDS for re- 
cent registration information of the second user-terminal 
UT2, and the connection establishment request sending 
means CERSM1, that is adapted to notify the second 
user-terminal about an incoming call from a first user- 
terminal. 

[0024] The user-terminal connect notification recep- 
tion means UTCNRM has an input-terminal that is at the 
same time an input-terminal l 0 of the subscriber data 
server SDS. This user-terminal connect notification up- 
dating means UTCNRM is coupled to the user-terminal 
connect notification updating means UTCNUM which al- 
so has an output-terminal that is at the same time is an 
input/output-terminal \IO^ of the subscriber data server 
SDS. 

[0025] The connection establishment request recep- 
tion means CERRM has an input-terminal that is at the 
same time an input-terminal I-, of the subscriber data 
server SDS and is coupled to the registration informa- 
tion searching means RISM. This registration informa- 
tion searching means RISM, has an input-terminal that 
at the same time is an input/output-terminal l/0 1 of the 
subscriber data server SDS and further is coupled to the 
connection establishment request sending means 
CERSM 1 . The connection establishment request send- 
ing means CERSM1 has an output-terminal that is at 
the same time an output-terminal 0 1 of the subscriber 
data server SDS. 

[0026] The second user-terminal UT2 as presented in 
FIG. 4 is built-up of the connection establishment re- 
quest reception means CERRM3, which is able to re- 
ceive a connection request from the subscriber data 
server SDS to establish a connection between the first 
and the second user-terminal, and an incoming call han- 
dling means ICHM that is adapted to handle the con- 
nection request from the first user-terminal. At last there 
is a switch requesting means SRM that is adapted to 
request the respective network access server to switch 
the connection of the second user-terminal UT2 from the 
second virtual private network to the first virtual private 
network. 

The connection establishment request reception means 
CERRM3 has an input-terminal that is at the same time 
an input-terminal l 3 of this second user-terminal UT2. 
Further, the connection establishment request reception 



means CERRM3 is coupled to the incoming call han- 
dling means ICHM, that in its turn is coupled to the 
switch requesting means SRM. The switch requesting 
means SRM has an output-terminal that is coupled to 
5 an output-terminal 0 3 of the second user-terminal UT2. 
[0027] The network access server NAS2 as present- 
ed in FIG. 5 may alternatively being built up of a con- 
nection establishment request reception means 
CERRM4 that is adapted to receive a connection re- 
10 quest from the first user-terminal UT1 to establish a con- 
nection between the first user-terminal UT1 that is con- 
nected to the first virtual private network and the second 
user-terminal UT2 that is connected to the second vir- 
tual private network and further a connection establish- 
es ment request sending means CERSM4 that is adapted 
to notify the subscriber data server SDS about an in- 
coming call from the first user-terminal UT1 . 
[0028] The connection establishment request recep- 
tion means CERRM4 has an input-terminal that at the 
20 same time is an input-terminal l 5 of the network access 
server NAS2. The connection establishment request re- 
ception means CERRM4 in its turn is coupled to the con- 
nection establishment request sending means 
CERSM4 that subsequently has an output-terminal that 
25 is at the same time an output-terminal 0 5 of the network 
access server NAS2. 

[0029] In order to explain the actual operation of the 
present invention it is assumed that a second user-ter- 
minal UT2 is connected to network access server NASI 

30 and is connected to a second virtual private network. It 
is furtherassumed that another user-terminal, a first us- 
er-terminal UT1 connected to network access server 
NAS2 and forms part of a first virtual private network 
tries to contact the second user-terminal UT2. 

35 [0030] According procedures that are well known in 
the art by the persons skilled in the art and therefor not 
described, the first user-terminal UT1 tries to obtain the 
Internet address, further referred to as the IP-address; 
of the to be contacted second user-terminal UT2. 

40 [0031 ] Because both user-terminals are not connect- 
ed to the same virtual private network it is not possible 
to connect both user-terminals. The first user-terminal 
will request the subscriber data server SDS for a con- 
nection to this second user-terminal by sending the con- 

45 nection request over a transparent connection between 
the first user-terminal and the subscriber data server via 
the.network access server NAS2. 
[0032] Alternatively the connection request can be 
sent to a connection establishment request reception 

50 means of network access sever NAS2 that receives this 
connection request from the first user-terminal to estab- 
lish a connection between the first user-terminal con- 
nected to a first virtual private network and the second 
user-terminal connected to the second virtual private 

55 network. Subsequently the connection establishment 
request sending means of network access sever NAS2 
notifies the subscriber data server about an incoming 
call from the first user-terminal. 
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[0033] This may also be performed by the connection 
establishment request reception means CERRM4 of 
NAS2 that receives this connection request from the first 
user-terminal UT1 to establish a connection between 
the first user-terminal connected to a first virtual private 
network and the second user-terminal connected to the 
second virtual private network. Subsequently the con- 
nection establishment request sending means 
CERSM4 notifies the subscriber data server about an 
incoming call from the first user-terminal. 
[0034] The connection establishmeni request recep- 
tion means CERRM of the subscriber data server SDS 
receives this connection request from the first user-ter- 
minal. Subsequently the registration information 
searching means RISM starts searching in the belong- 
ing database DB of the subscriber data server SDS for 
connection information of this second user-terminal 
UT2. 

[0035] The user-terminal connect notification sending 
means HCNSM sends connection information to the us- 
er-terminal connect notification reception means UTC- 
NRM of the subscriber data server SDS at connecting 
of the second user-terminal to the respective network 
access server NASI or at switch-over to another virtual 
private network. The user-terminal connect notification 
reception means UTCNRM of the subscriber data serv- 
er SDS receives this registration and forwards it to the 
user-terminal connect notification updating means 
UTCNUM that updates the database DB of the subscrib- 
er data server SDS with the recently received connec- 
tion information. This registration information contains 
information to which network access server a user-ter- 
minal is connected and which virtual private network that 
user-terminal forms part of. There is also a list main- 
tained for each user on which virtual private network the 
user has a subscription on. 

[0036] The connection information searching means 
RISM then retrieves the connection information of the 
second user-terminal UT2. This connection information 
contains the information that the user of second user- 
terminal UT2 amongst others has also a subscription to 
the first virtual private network and that this second user- 
terminal UT2 is connected to network access server 
NASI and that it currently is connected to the second 
virtual private network. Using this information, the con- 
nection establishment request sending means 
CERSM1 will notify the second user-terminal UT2 about 
an incoming call from the first user-terminal UT1 via a 
transparent connection between the subscriber data 
server SDS and the second user-terminal UT2 via net- 
work access server NASI. 

[0037] The notification of the second user-terminal 
UT2 about an incoming call from the first user-terminal 
UTi may alternatively be done by sending the incoming 
call notification to the connection establishment request 
reception means CERRM1 that receives a connection 
request from the subscriber data server to establish the 
connection between the first user-terminal connected to 



the first virtual private network and the second user-ter- 
minal connected to the second virtual private network 
via the network access server. Subsequently the con- 
nection establishment request sending means 
5 CERSM2 notifies the second user-terminal about an in- 
coming call from the first user-terminal. 
[0038] The connection establishment request recep- 
tion means CERRM3 of the second user-terminal re- 
ceives the connection request sent by subscriber data 

10 server SDS and subsequently forwards this notification 
to the incoming call handling means ICHM that handles 
this connection request from the first user-terminal by. 
assume a pop-up screen requesting the user of the sec- 
ond user-terminal UT2 to accept an incoming call from 

15 this first user-terminal and postpone or finish the ongo- 
ing communication. If the user decides to accept the in- 
coming call from the first user-terminal the current com- 
munication is finished and the switch requesting means 
SRM. of the second user-terminal requests the network 

so access server NASI to switch the connection of the sec- 
ond user-terminal from the second virtual private net- 
work to the first virtual private network. The switch noti- 
fication reception means SNRM, receives the request 
from the second user-terminal to initiate a switch-over 

25 of the connection of the second user-terminal from the 
second virtual private network to the first virtual private 
network and forwards it to the switching means SM that 
finally performs the switch. At that time both the second 
and the first user-terminal form part of the same private 

30 network. 

[0039] This means that the communication between 
the first user-terminal and the second user-terminal fur- 
ther can be established according to the previously 
mentioned procedures that are well known by persons 

35 skilled in the art. 

[0040] The user-terminal connect notification sending 
means HCNSM further sends the updated registration 
information to the subscriber data server at connecting 
of said second user-terminal to the first virtual private 

40 network. 

[0041] It is further to be remarked that any other com- 
munications network could have been described in this 
embodiment. 

[0042] Another further remark is that the network as 
45 described in the previous embodiment may act as a sub- 
network of large network consisting of a n umber of these 
networks. In this way the network consists of a number 
of distributed subscriber data servers co-operating in or- 
der to perform the method as described for any of the 
50 sub-networks. 

[0043] Although the above embodiment of the inven- 
tion has been described by means of functional blocks, 
their detailed realisation based on this functional de- 
scription should be obvious for a person skilled in the 
55 art and is therefore not described. 

[0044] While the principles of the invention have been 
described above in connection with specific apparatus, 
it is to be clearly understood that this description is made 



BNSDOCID: <EP 1093255A1J_> 



9 



EP1093 255 A1 



10 



only by way of example and not as a limitation on the 
scope of the invention, as defined in the appended 

claims. 



Claims 

1 . Method for connecting a first user-terminal (UT1 ) to 
a second user-terminal (UT2) over a network such 
as the internet and said network containing a plu- 
rality of user-terminals (UT1 , UT2) and a plurality of 
network access servers (NASI , NAS2, NAS3) each 
of said plurality of user-terminals (UT1, UT2) being 
coupled to a respective network access server of 
said plurality of network access servers (NASI , 
NAS2, NAS3), CHARACTERISED IN THAT said 
method comprises the steps of : 

a. at connection of said second user-terminal 
(UT2) to its respective network access server 
(NASI ) sending connection information by said 
respective network access server (NASI ) to a 
subscriber data server (SDS) included in said 
network and coupled to each network access 
server (NASI , NAS2, NAS3); 

b. updating a database of said subscriber data 
server (SDS) with said connection information; 

c. handling by said subscriber data server 
(SDS) of an incoming call request from said first 
user-terminal (UT1) in order to establish a con- 
nection between said first user-terminal (UT1) 
and said second user-terminal (UT2) said first 
user-terminal (UT1) being connected to a first 
virtual private network, said second user-termi- 
nal (UT2) being connected to a second virtual 
private network; 

d. searching in said database of said subscriber 
data server (SDS) forconnection information of 
said second user-terminal (UT2); 

e. said subscriber data server (SDS) determin- 
ing said respective network access server 
(NASI) connected to said second user-termi- 
nal (UT2), using said connection information; 

f. notifying said second user-terminal (UT2) 
about said requesting of said communication 
by said first user-terminal (UT1); 

g. said second user-terminal (UT2) initiating 
and controlling a switch-over of said connection 
of said second user-terminal (UT2) from said 
second virtual private network to said first vir- 
tual private network; 

h. said respective network access server 
(NASI) of said second user-terminal (UT2) 
switching said connection of said second user- 
terminal (UT2) from said second virtual private 
network to said first virtual private network; and 

i. At switch-over of said connection of said 
second user-terminal (UT2) from said second 



virtual private network to said first virtual private 
network sending connection information by 
said respective network access server (NASI ) 
to said subscriber data server (SDS). 

5 

2. Method according to claim 1 , CHARACTERISED IN 

THAT said step of notifying said second user-termi- 
nal (UT2) about said requesting of said communi- 
cation by said first user-terminal (UT1 ) is performed 
10 . according to the following steps of: 

a. receiving said incoming call request of said 
subscriber data server (SDS) at said respective 
network access server (NASI) connected to 

is said second user-terminal (UT2); and 

b. said respective network access server 
(NASI) connected to said second user-termi- 
nal (UT2) sending said incoming call request of 
said first user-terminal (UT1 ) to said second us- 

20 er-terminal (UT2). 

3. Method according to claim 1, CHARACTERISED IN 

THAT said step of notifying said second user-termi- 
nal (UT2) about said requesting of said communi- 

25 cation by said first user-terminal (UT1 ) is performed 
over a transparent connection between said sub- 
scriber data server (SDS) and said second user-ter- 
minal (UT2) via said respective network access 
server (NASI) connected to said second user-ter- 

30 minal (UT2). 

4. Method according to claim 1 , CHARACTERISED IN 
THAT said method further comprises before step c, 
the steps of: 

35 

a. receiving said incoming call request of said 
first user-terminal (UT2) at said respective net- 
work access server (NAS2) connected to said 
first user-terminal (UT1 ); and 
40 p. said respective network access server 

(NAS2) connected to said first user-terminal 
(UT1) sending said incoming call request of 
said first user-terminal (UT1 ) to said subscriber 
data server (SDS). 

45 

5. Method according to claim t , CHARACTERISED IN 
THAT said method further comprises before step c, 
the step of sending said incoming call request of 
said first user-terminal (UT1) over a transparent 

so connection between said first user-terminal (UT1) 
and said subscriber data server (SDS) via said net- 
work access server (NAS2) connected to said first 
user-terminal. 

55 6. Network Access Server (N AS 1 ) for enabling a con- 
nection between a first user-terminal (UT1 ) and a 
second user-terminal (UT2) over a network such as 
the internet, said network containing a plurality of 
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user-terminals (UT1 , UT2) and a plurality of network 
access servers (NASI, NAS2, NAS3) each of said 
plurality of user-terminals (UT1, UT2) being cou- 
pled to a respective network access server of said 
plurality of network access servers (NASI, NAS2, 5 
NAS3), 

CHARACTERISED IN THAT said network access 
server (NASI) comprises the following means to 
enable said connection using the method according 
to claim 1: 10 

a. switch notification reception means (SNRM), 
adapted to receive a request from said second 
user-terminal (UT2) to initiate a switch-over of 

a connection of said second user-terminal 15 
(UT2) from a second virtual private network to 
a first virtual private network; 

b. switching means (SM), coupled with an input 
to an output of said switch notification reception 
means (SNRM) and adapted to perform said 20 
switch-over of said connection of said second 
user-terminal (UT2) from said second virtual 
private network to said first virtual private net- 
work; and 

c. user-terminal connect notification sending & 
means (HCNSM), coupled with an Input to an 
output of said switching means (SM) and adapt- 
ed to send connection information to said sub- 
scriber data server (SDS) at connecting of said 
second user-terminal (UT2) to said respective 30 
network access server (NASI) and at switch- 
over of said connection of said second user-ter- 
minal (UT2) from said second virtual private 
network to said first virtual private network. 

35 

7. Network access server (NASI) according to claim 
6, CHARACTERISED IN THAT said network ac- 
cess server (NASI) further comprises: 

a. connection establishment request reception 40 
means (CERRM1), adapted to receive a con- 
nection request from said subscriber data serv- 
er (SDS) to establish said connection between 
said first user-terminal (UT1 ) connected to said 
first virtual private network and said second us- 
er-terminal (UT2) connected to said second vir- 
tual private network via said respective network 
access server (NASI); and 

b. connection establishment request sending 
means (CERSM2), coupled with an input to an so 
output of said connection establishment re- 
questing reception means (CERRM1) and 
adapted to notify said second user-terminal 
(UT2) about an incoming call from said first us- 
er-terminal (UT1). 55 

8. Network Access Server (NAS2), for enabling a con- 
nection between a first user-terminal (UT1) and a 



second user-terminal (UT2) over a network such as 
the internet, said network containing a plurality of 
user-terminals (UT1 , UT2) and a plurality of network 
access servers (NAS1.NAS2, NAS3) each of said 
plurality of user-terminals (UT1 , UT2) being cou- 
pled to a respective network access server of said 
plurality of network access servers (NAS1.NAS2, 
NAS3). CHARACTERISED IN THAT said network 
access server (NAS2) comprises the following 
means to enable said connection using the method 
according to claim 2: 

a. connection establishment request reception 
means (CERRM4), adapted to receive a con- 
nection request from said first user-terminal 
(UT1) to establish said connection between 
said first user-terminal (UT1 ) connected to said 
first virtual private network and said second us- 
er-terminal (UT2) connected to said second vir- 
tual private network; and 

b. connection establishment request sending 
means (CERSM4), coupled with an input to an 
output of said connection establishment re- 
questing reception means (CERRM4) and 
adapted to notify said subscriber data server 
(SDS) about an incoming call from said first us- 
er-terminal (UT1). 

9. Network access server according to claim 6, CHAR- 
ACTERISED IN THAT said Network access server 
further comprises: 

a. connection establishment request reception 
means (CERRM2), adapted to receive a con- 
nection request from said first user-terminal 
(UT1) to establish said connection between 
said first user-terminal (UT1) connected to said 
first virtual private network and said second us- 
er-terminal (UT2) connected to said second vir- 
tual private network; and 

b. connection establishment request sending 
means (CERSM3), coupled with an input to an 
output of said connection establishment re- 
questing reception means (CERRM2) and 
adapted to notify said subscriber data server 
(SDS) about an incoming call from said first us- 
er-terminal (UT1). 

10. Subscriber Data Server (SDS), for enabling a con- 
nection of a first user-terminal (UT1 ) to a second 
user-terminal (UT2) over a network such as the in- 
ternet, said network containing a plurality of user- 
terminals (UT1 , UT2) and a plurality of network ac- 
cess servers (NASI , NAS2. NAS3) each of said plu- 
rality of user-terminals (UT1 , UT2) being coupled to 
a respective network access server of said plurality 
of network access servers (NASI, NAS2, NAS3) 
and said subscriber data server (SDS) being cou- 
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pled to each network access server of said plurality 
of network access servers (NASI , NAS2, NAS3), 
said subscriber data server comprises the following 
means to enable said connection using the method 
according to claim 1 : s 

a. user-terminal connect notification reception 
means (UTCNRM), adapted to receive said 
connection information at connection of said 
second user-terminal (UT2) to said respective w 
network access server (NASI) and at switch- 
over of said connection of said second user-ter- 
minal (UT2) from said second virtual private 
network to said first virtual private network; 

b. user-terminal connect notification updating '5 
means (UTCNUM) coupled with an input to an 
output of said user-terminal connect notifica- 
tion reception means (UTCNRM) and adapted 

to update a database of said subscriber data 
server (SDS) with said connection information; 20 

c. connection establishment request reception 
means (CERRM), adaptedto receive a connec- 
tion request from said first user-terminal (UT1) 
to establish a connection between said first us- 
er-terminal (UT1 ) connected to a first virtual pri- 25 
vate network and said second user-terminal 
(UT2) connected to said second virtual private 
network; 

d. connection information searching means 
(RISM), coupled with an input to an output of so 
said connection establishment request recep- 
tion means (CERRM) and adapted to search in 
said database of said subscriber data server 
(SDS) for connection information of said sec- 
ond user-terminal (UT2); and 35 

e. connection establishment request sending 
means (CERSM1), coupled with an input to an 
output of said Connection information search- 
ing means (RISM) and adapted to notify said 
second user-terminal (UT2) about an incoming 40 
call from said first user-terminal (UT1). 

11. Second user-terminal (UT2), for inclusion in a net- 
work such as the internet containing a plurality of 
such user-terminals and a plurality of network ac- « 
cess servers (NASI , NAS2, NAS3) each of said plu- 
rality of user-terminals (UT1 , UT2) being coupled to 
a respective network access server of said plurality 
of network access servers (NASI, NAS2, NAS3), 
CHARACTERISED IN THAT said second user-ter- so 
minal (UT2) comprises the following means for en- 
abling a connection between a first user-terminal 
(UT1 ) and itself over said network using a method 
according to claim 1 : 

55 

a. connection establishment request reception 
means (CERRM3), adapted to receive a con- 
nection request from said first user-terminal 



(UT1) via its respective network access server 
(NAS2) to establish a connection to said sec- 
ond user-terminal (UT2); 

b. incoming call handling means (ICHM), cou- 
pled with an input to an output of said connec- 
tion establishment request reception means 
(CERRM3) and adapted to handle said connec- 
tion request from said first user-terminal (UT1 ); 
and 

c. switch requesting means (SRM), coupled 
with an input to an output of said incoming call 
handling means (ICHM) and adapted to re- 
quest said respective network access server 
(NASI) to switch said connection of said sec- 
ond user-terminal (UT2) from a second virtual 
private network to a first virtual private network. 

12. Software module for running on a processing sys- 
tem for inclusion in a Subscriber Data Server (SDS) 
and for enabling a connection of a first user-terminal 
(UT1) to a second user-terminal (UT2) over a net- 
work such as the internet, said network containing 
a plurality of user-terminals (UT1 , UT2) and a plu- 
rality of network access servers (NASI, NAS2, 
NAS3) each of said plurality of user-terminals (UT1 , 
UT2) being coupled to a respective network access 
server of said plurality of network access servers 
(NASI, NAS2, NAS3) and said subscriber data 
server (SDS) being coupled to each network access 
server of said plurality of network access servers 
(NASI , NAS2, NAS3), said software module com- 
prises the following software sub-modules to ena- 
ble said connection using the method according to 
claim 1 : 

a. user-terminal connect notification reception 
sub-module, adapted to receive said connec- 
tion information at connection of said second 
user-terminal (UT2j to said respective network 
access server (NASI) and at switch-over of 
said connection of said second user-terminal 
(UT2) from said second virtual private network 
to said first virtual private network; 

b. user-terminal connect notification updating 
sub-module, co-operating with said user-termi- 
nal connect notification reception sub-module 
and adapted to update a database of said sub- 
scriber data server (SDS) with said connection 
information; 

c. connection establishment request reception 
sub-module, adapted to receive a connection 
request from said first user-terminal (UT1) to 
establish a connection between said first user- 
terminal (UT1) connected to a first virtual pri- 
vate network and said second user-terminal 
(UT2) connected to said second virtual private 
network; 

d. connection information searching sub-mod- 
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ule, co-operating said connection establish- 
ment request reception sub-module and adapt- 
ed to search in said database of said subscriber 
data server (SDS) for connection information of 
said second user-terminal (UT2); and 5 
e. connection establishment request sending 
sub-module, co-operating with said connection 
information searching sub-module and adapt- 
ed to notify said second user-terminal (UT2) 
about an incoming call from said first user-ter- w 
minal (UT1). 

13. Software module for running on a processing sys- 
tem for inclusion in a second user terminal (UT2) 
and for inclusion in a network such as the internet is 
containing a plurality of such user-terminals and a 
plurality of network access servers (NASI, NAS2, 
NAS3) each of said plurality of user-terminats (UT1 , 
UT2) being coupled to a respective network access 
server of said plurality of network access servers 20 
(NASI, NAS2, NAS3), CHARACTERISED IN 
THAT said software module comprises the follow- 
ing software sub-modules for enabling a connection 
between a first user-terminal (UT1) and itself over 
said network using a method according to claim 1 : 25 

a. connection establishment request reception 
sub-module, adapted to receive a connection 
request from said first user-terminal (UT1 ) via 

its respective network access server (NAS2) to so 
establish a connection to said second user-ter- 
minal (UT2); 

b. incoming call handling sub-module, co-oper- 
ating with said connection establishment re- 
quest reception sub-module and adapted to 35 
handle said connection request from said first 
user-terminal (UT1); and 

c. switch requesting sub-module, co-operating 
with said incoming call handling sub-module 
and adapted to request said respective network *o 
access server (NASI) to switch said connec- 
tion of said second user-terminal (UT2) from a 
second virtual private network to a first virtual 
private network. 
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